Get rid of BindingsPolicy::EXTENSION

BUG=89642
TEST=everything still works


Review URL: http://codereview.chromium.org/8052032

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@103654 0039d316-1c4b-4281-b951-d872f2087c98

16 files changed, 153 insertions, 130 deletions

diff --git a/chrome/browser/browser_process_impl.cc b/chrome/browser/browser_process_impl.cc
index e3087a3..ae38669 100644
--- a/chrome/browser/browser_process_impl.cc
+++ b/chrome/browser/browser_process_impl.cc
@@ -162,6 +162,9 @@ BrowserProcessImpl::BrowserProcessImpl(const CommandLine& command_line)
 
   net_log_.reset(new ChromeNetLog);
 
+  ChildProcessSecurityPolicy::GetInstance()->RegisterWebSafeScheme(
+      chrome::kExtensionScheme);
+
   extension_event_router_forwarder_ = new ExtensionEventRouterForwarder;
 
   ExtensionTabIdMap::GetInstance()->Init();
diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
index 6e42211..4709e32 100644
--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc
@@ -267,7 +267,8 @@ bool ChromeContentBrowserClient::IsSuitableHost(
 
   bool is_extension_host =
       process_host->is_extension_process() ||
-      extension_process_manager->IsExtensionProcessHost(process_host->id());
+      extension_process_manager->AreBindingsEnabledForProcess(
+          process_host->id());
   return site_url.SchemeIs(chrome::kExtensionScheme) == is_extension_host;
 }
 
diff --git a/chrome/browser/extensions/extension_event_router.cc b/chrome/browser/extensions/extension_event_router.cc
index 581368d..3b88961 100644
--- a/chrome/browser/extensions/extension_event_router.cc
+++ b/chrome/browser/extensions/extension_event_router.cc
@@ -8,6 +8,7 @@
 #include "base/values.h"
 #include "chrome/browser/extensions/extension_devtools_manager.h"
 #include "chrome/browser/extensions/extension_host.h"
+#include "chrome/browser/extensions/extension_process_manager.h"
 #include "chrome/browser/extensions/extension_processes_api.h"
 #include "chrome/browser/extensions/extension_processes_api_constants.h"
 #include "chrome/browser/extensions/extension_service.h"
@@ -253,8 +254,12 @@ void ExtensionEventRouter::DispatchEventImpl(
   // Send the event only to renderers that are listening for it.
   for (std::set<EventListener>::iterator listener = listeners.begin();
        listener != listeners.end(); ++listener) {
-    if (!ChildProcessSecurityPolicy::GetInstance()->
-            HasExtensionBindings(listener->process->id())) {
+    Profile* listener_profile = Profile::FromBrowserContext(
+        listener->process->browser_context());
+    ExtensionProcessManager* extension_process_manager =
+        listener_profile->GetExtensionProcessManager();
+    if (!extension_process_manager->AreBindingsEnabledForProcess(
+        listener->process->id())) {
       // Don't send browser-level events to unprivileged processes.
       continue;
     }
@@ -274,7 +279,7 @@ void ExtensionEventRouter::DispatchEventImpl(
     // Is this event from a different profile than the renderer (ie, an
     // incognito tab event sent to a normal process, or vice versa).
     bool cross_incognito = event->restrict_to_profile &&
-        listener->process->browser_context() != event->restrict_to_profile;
+        listener_profile != event->restrict_to_profile;
     // Send the event with different arguments to extensions that can't
     // cross incognito, if necessary.
     if (cross_incognito && !service->CanCrossIncognito(extension)) {
diff --git a/chrome/browser/extensions/extension_function_dispatcher.cc b/chrome/browser/extensions/extension_function_dispatcher.cc
index 91c470e..dcec789 100644
--- a/chrome/browser/extensions/extension_function_dispatcher.cc
+++ b/chrome/browser/extensions/extension_function_dispatcher.cc
@@ -61,7 +61,6 @@
 #include "chrome/browser/ui/browser_window.h"
 #include "chrome/common/extensions/extension_messages.h"
 #include "chrome/common/url_constants.h"
-#include "content/browser/child_process_security_policy.h"
 #include "content/browser/renderer_host/render_process_host.h"
 #include "content/browser/renderer_host/render_view_host.h"
 #include "ipc/ipc_message.h"
@@ -518,9 +517,16 @@ void ExtensionFunctionDispatcher::DispatchOnIOThread(
   const Extension* extension =
       extension_info_map->extensions().GetByURL(params.source_url);
 
-  scoped_refptr<ExtensionFunction> function(
-      CreateExtensionFunction(params, extension, profile, render_process_id,
-                              ipc_sender, routing_id));
+  if (!extension_info_map->AreBindingsEnabledForProcess(render_process_id)) {
+    // TODO(aa): Allow content scripts access to low-threat extension APIs.
+    // See: crbug.com/80308.
+    LOG(ERROR) << "Extension API called from non-extension process.";
+    SendAccessDenied(ipc_sender, routing_id, params.request_id);
+    return;
+  }
+
+  scoped_refptr<ExtensionFunction> function(CreateExtensionFunction(
+      params, extension, profile, ipc_sender, routing_id));
   if (!function)
     return;
 
@@ -576,7 +582,9 @@ void ExtensionFunctionDispatcher::Dispatch(
     const ExtensionHostMsg_Request_Params& params,
     RenderViewHost* render_view_host) {
   ExtensionService* service = profile()->GetExtensionService();
-  if (!service)
+  ExtensionProcessManager* extension_process_manager =
+      profile()->GetExtensionProcessManager();
+  if (!service || !extension_process_manager)
     return;
 
   if (!service->ExtensionBindingsAllowed(params.source_url)) {
@@ -586,6 +594,15 @@ void ExtensionFunctionDispatcher::Dispatch(
                      params.request_id);
     return;
   }
+  if (!extension_process_manager->AreBindingsEnabledForProcess(
+      render_view_host->process()->id())) {
+    // TODO(aa): Allow content scripts access to low-threat extension APIs.
+    // See: crbug.com/80308.
+    LOG(ERROR) << "Extension API called from non-extension process.";
+    SendAccessDenied(render_view_host, render_view_host->routing_id(),
+                     params.request_id);
+    return;
+  }
 
   // TODO(aa): When we allow content scripts to call extension APIs, we will
   // have to pass the extension ID explicitly here, not use the source URL.
@@ -593,10 +610,9 @@ void ExtensionFunctionDispatcher::Dispatch(
   if (!extension)
     extension = service->GetExtensionByWebExtent(params.source_url);
 
-  scoped_refptr<ExtensionFunction> function(CreateExtensionFunction(
-      params, extension, profile_,
-      render_view_host->process()->id(),
-      render_view_host, render_view_host->routing_id()));
+  scoped_refptr<ExtensionFunction> function(
+      CreateExtensionFunction(params, extension, profile(), render_view_host,
+                              render_view_host->routing_id()));
   if (!function)
     return;
 
@@ -630,24 +646,8 @@ ExtensionFunction* ExtensionFunctionDispatcher::CreateExtensionFunction(
     const ExtensionHostMsg_Request_Params& params,
     const Extension* extension,
     void* profile,
-    int render_process_id,
     IPC::Message::Sender* ipc_sender,
     int routing_id) {
-  // TODO(aa): It would be cool to use ExtensionProcessManager to track which
-  // processes are extension processes rather than ChildProcessSecurityPolicy.
-  // EPM has richer information: it not only knows which processes contain
-  // at least one extension, but it knows which extensions are inside and what
-  // permissions the have. So we would be able to enforce permissions more
-  // granularly.
-  if (!ChildProcessSecurityPolicy::GetInstance()->HasExtensionBindings(
-          render_process_id)) {
-    // TODO(aa): Allow content scripts access to low-threat extension APIs.
-    // See: crbug.com/80308.
-    LOG(ERROR) << "Extension API called from non-extension process.";
-    SendAccessDenied(ipc_sender, routing_id, params.request_id);
-    return NULL;
-  }
-
   if (!extension) {
     LOG(ERROR) << "Extension does not exist for URL: "
                << params.source_url.spec();
diff --git a/chrome/browser/extensions/extension_function_dispatcher.h b/chrome/browser/extensions/extension_function_dispatcher.h
index 9ff2ec4..f700d8f 100644
--- a/chrome/browser/extensions/extension_function_dispatcher.h
+++ b/chrome/browser/extensions/extension_function_dispatcher.h
@@ -118,7 +118,6 @@ class ExtensionFunctionDispatcher
       const ExtensionHostMsg_Request_Params& params,
       const Extension* extension,
       void* profile,
-      int render_process_id,
       IPC::Message::Sender* ipc_sender,
       int routing_id);
 
diff --git a/chrome/browser/extensions/extension_info_map.cc b/chrome/browser/extensions/extension_info_map.cc
index 29462cc..6e9e4aa 100644
--- a/chrome/browser/extensions/extension_info_map.cc
+++ b/chrome/browser/extensions/extension_info_map.cc
@@ -94,3 +94,17 @@ bool ExtensionInfoMap::CanCrossIncognito(const Extension* extension) {
   return IsIncognitoEnabled(extension->id()) &&
       !extension->incognito_split_mode();
 }
+
+// These are duplicated from ExtensionProcessManager :(.
+void ExtensionInfoMap::BindingsEnabledForProcess(int host_id) {
+  extension_bindings_process_ids_.insert(host_id);
+}
+
+void ExtensionInfoMap::BindingsDisabledForProcess(int host_id) {
+  extension_bindings_process_ids_.erase(host_id);
+}
+
+bool ExtensionInfoMap::AreBindingsEnabledForProcess(int host_id) const {
+  return extension_bindings_process_ids_.find(host_id) !=
+      extension_bindings_process_ids_.end();
+}
diff --git a/chrome/browser/extensions/extension_info_map.h b/chrome/browser/extensions/extension_info_map.h
index f8fe68e..2736165 100644
--- a/chrome/browser/extensions/extension_info_map.h
+++ b/chrome/browser/extensions/extension_info_map.h
@@ -6,6 +6,7 @@
 #define CHROME_BROWSER_EXTENSIONS_EXTENSION_INFO_MAP_H_
 #pragma once
 
+#include <set>
 #include <string>
 
 #include "base/basictypes.h"
@@ -49,6 +50,15 @@ class ExtensionInfoMap : public base::RefCountedThreadSafe<ExtensionInfoMap> {
   // sub-profile (incognito to original profile, or vice versa).
   bool CanCrossIncognito(const Extension* extension);
 
+  // Registers a RenderProcessHost with |host_id| as hosting an extension.
+  void BindingsEnabledForProcess(int host_id);
+
+  // Unregisters the RenderProcessHost with |host_id|.
+  void BindingsDisabledForProcess(int host_id);
+
+  // True if this process host is hosting an extension.
+  bool AreBindingsEnabledForProcess(int host_id) const;
+
  private:
   // Extra dynamic data related to an extension.
   struct ExtraData;
@@ -60,6 +70,9 @@ class ExtensionInfoMap : public base::RefCountedThreadSafe<ExtensionInfoMap> {
 
   // Extra data associated with enabled extensions.
   ExtraDataMap extra_data_;
+
+  // The set of process ids that have extension bindings enabled.
+  std::set<int> extension_bindings_process_ids_;
 };
 
 #endif  // CHROME_BROWSER_EXTENSIONS_EXTENSION_INFO_MAP_H_
diff --git a/chrome/browser/extensions/extension_process_manager.cc b/chrome/browser/extensions/extension_process_manager.cc
index 1db0def..f31ac69 100644
--- a/chrome/browser/extensions/extension_process_manager.cc
+++ b/chrome/browser/extensions/extension_process_manager.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "base/bind.h"
 #include "base/command_line.h"
 #include "chrome/browser/extensions/extension_process_manager.h"
 
@@ -11,6 +12,7 @@
 #include "chrome/browser/extensions/extension_host_mac.h"
 #endif
 #include "chrome/browser/extensions/extension_host.h"
+#include "chrome/browser/extensions/extension_info_map.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/browser.h"
@@ -18,6 +20,7 @@
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/extensions/extension.h"
 #include "chrome/common/url_constants.h"
+#include "content/browser/browser_thread.h"
 #include "content/browser/site_instance.h"
 #include "content/browser/tab_contents/tab_contents.h"
 #include "content/common/notification_service.h"
@@ -104,9 +107,6 @@ ExtensionProcessManager::ExtensionProcessManager(Profile* profile)
   // |site_instance_id| in UnregisterExtensionSiteInstance.
   registrar_.Add(this, content::NOTIFICATION_SITE_INSTANCE_DELETED,
                  NotificationService::AllBrowserContextsAndSources());
-  // Same for NOTIFICATION_RENDERER_PROCESS_CLOSED.
-  registrar_.Add(this, content::NOTIFICATION_RENDERER_PROCESS_CLOSED,
-                 NotificationService::AllBrowserContextsAndSources());
   registrar_.Add(this, content::NOTIFICATION_APP_TERMINATING,
                  NotificationService::AllSources());
 }
@@ -231,34 +231,86 @@ ExtensionHost* ExtensionProcessManager::GetBackgroundHostForExtension(
 }
 
 void ExtensionProcessManager::RegisterExtensionSiteInstance(
-    int site_instance_id, const std::string& extension_id) {
+    SiteInstance* site_instance,
+    const Extension* extension) {
+  if (!site_instance->HasProcess()) {
+    NOTREACHED();
+    return;
+  }
+
+  int site_instance_id = site_instance->id();
+  int host_id = site_instance->GetProcess()->id();
+  process_ids_[host_id].insert(site_instance_id);
+
+  // Register process hosting extensions that have access to extension bindings
+  // with the ExtensionInfoMap on the IO thread.
+  Profile* profile =
+      Profile::FromBrowserContext(browsing_instance_->browser_context());
+  ExtensionService* service = profile->GetExtensionService();
+  if (service->ExtensionBindingsAllowed(extension->url())) {
+    Profile* profile = Profile::FromBrowserContext(
+        site_instance->GetProcess()->browser_context());
+    BrowserThread::PostTask(
+        BrowserThread::IO, FROM_HERE,
+        base::Bind(&ExtensionInfoMap::BindingsEnabledForProcess,
+                   profile->GetExtensionInfoMap(),
+                   host_id));
+  }
+
   SiteInstanceIDMap::const_iterator it = extension_ids_.find(site_instance_id);
-  if (it != extension_ids_.end() && (*it).second == extension_id)
+  if (it != extension_ids_.end() && (*it).second == extension->id())
     return;
 
   // SiteInstance ids should get removed from the map before the extension ids
   // get used for a new SiteInstance.
   DCHECK(it == extension_ids_.end());
-  extension_ids_[site_instance_id] = extension_id;
+  extension_ids_[site_instance_id] = extension->id();
 }
 
 void ExtensionProcessManager::UnregisterExtensionSiteInstance(
-    int site_instance_id) {
+    SiteInstance* site_instance) {
+  int site_instance_id = site_instance->id();
   SiteInstanceIDMap::iterator it = extension_ids_.find(site_instance_id);
-  if (it != extension_ids_.end())
+  if (it != extension_ids_.end()) {
     extension_ids_.erase(it++);
+  }
+  if (site_instance->HasProcess()) {
+    int host_id = site_instance->GetProcess()->id();
+    ProcessIDMap::iterator host = process_ids_.find(host_id);
+    if (host != process_ids_.end()) {
+      host->second.erase(site_instance_id);
+      if (host->second.empty()) {
+        process_ids_.erase(host++);
+        Profile* profile = Profile::FromBrowserContext(
+            site_instance->GetProcess()->browser_context());
+        BrowserThread::PostTask(
+            BrowserThread::IO, FROM_HERE,
+            base::Bind(&ExtensionInfoMap::BindingsDisabledForProcess,
+                       profile->GetExtensionInfoMap(),
+                       host_id));
+      }
+    }
+  }
 }
 
-void ExtensionProcessManager::RegisterProcessHost(int host_id) {
-  process_ids_.insert(host_id);
-}
-
-void ExtensionProcessManager::UnregisterProcessHost(int host_id) {
-  process_ids_.erase(host_id);
-}
+bool ExtensionProcessManager::AreBindingsEnabledForProcess(int host_id) {
+  ProcessIDMap::iterator it = process_ids_.find(host_id);
+  if (process_ids_.find(host_id) == process_ids_.end())
+    return false;
 
-bool ExtensionProcessManager::IsExtensionProcessHost(int host_id) const {
-  return process_ids_.find(host_id) != process_ids_.end();
+  Profile* profile =
+      Profile::FromBrowserContext(browsing_instance_->browser_context());
+  ExtensionService* service = profile->GetExtensionService();
+  for (std::set<int>::iterator site_instance_id = it->second.begin();
+       site_instance_id != it->second.end(); ++site_instance_id) {
+    const Extension* extension =
+        GetExtensionForSiteInstance(*site_instance_id);
+    if (extension == NULL)
+      continue;
+    if (service->ExtensionBindingsAllowed(extension->url()))
+      return true;
+  }
+  return false;
 }
 
 RenderProcessHost* ExtensionProcessManager::GetExtensionProcess(
@@ -346,14 +398,7 @@ void ExtensionProcessManager::Observe(int type,
 
     case content::NOTIFICATION_SITE_INSTANCE_DELETED: {
       SiteInstance* site_instance = Source<SiteInstance>(source).ptr();
-      UnregisterExtensionSiteInstance(site_instance->id());
-      break;
-    }
-
-    case content::NOTIFICATION_RENDERER_PROCESS_CLOSED: {
-      RenderProcessHost* process_host =
-          Source<RenderProcessHost>(source).ptr();
-      UnregisterProcessHost(process_host->id());
+      UnregisterExtensionSiteInstance(site_instance);
       break;
     }
 
diff --git a/chrome/browser/extensions/extension_process_manager.h b/chrome/browser/extensions/extension_process_manager.h
index 3536ec4..b8219a3 100644
--- a/chrome/browser/extensions/extension_process_manager.h
+++ b/chrome/browser/extensions/extension_process_manager.h
@@ -69,22 +69,16 @@ class ExtensionProcessManager : public NotificationObserver {
   // Returns the SiteInstance that the given URL belongs to.
   virtual SiteInstance* GetSiteInstanceForURL(const GURL& url);
 
-  // Registers a SiteInstance with |site_instance_id| as hosting the extension
-  // with |extension_id|.
-  void RegisterExtensionSiteInstance(int site_instance_id,
-                                     const std::string& extension_id);
+  // Registers a SiteInstance as hosting a given extension.
+  void RegisterExtensionSiteInstance(SiteInstance* site_instance,
+                                     const Extension* extension);
 
-  // Unregisters the extension associated with |site_instance_id|.
-  void UnregisterExtensionSiteInstance(int site_instance_id);
+  // Unregisters the extension associated with |site_instance|.
+  void UnregisterExtensionSiteInstance(SiteInstance* site_instance);
 
-  // Registers a RenderProcessHost with |host_id| as hosting an extension.
-  void RegisterProcessHost(int host_id);
-
-  // Unregisters the RenderProcessHost with |host_id|.
-  void UnregisterProcessHost(int host_id);
-
-  // True if this process host is hosting an extension.
-  bool IsExtensionProcessHost(int host_id) const;
+  // True if this process host is hosting an extension with extension bindings
+  // enabled.
+  bool AreBindingsEnabledForProcess(int host_id);
 
   // Returns the extension process that |url| is associated with if it exists.
   // This is not valid for hosted apps without the background permission, since
@@ -135,8 +129,9 @@ class ExtensionProcessManager : public NotificationObserver {
   typedef std::map<int, std::string> SiteInstanceIDMap;
   SiteInstanceIDMap extension_ids_;
 
-  // A set of render process host IDs that have access to extension bindings.
-  std::set<int> process_ids_;
+  // A map of process ID to site instance ID of the site instances it hosts.
+  typedef std::map<int, std::set<int> > ProcessIDMap;
+  ProcessIDMap process_ids_;
 
   DISALLOW_COPY_AND_ASSIGN(ExtensionProcessManager);
 };
diff --git a/chrome/browser/memory_details.cc b/chrome/browser/memory_details.cc
index 85e7bbb..f8adcf9 100644
--- a/chrome/browser/memory_details.cc
+++ b/chrome/browser/memory_details.cc
@@ -9,6 +9,7 @@
 #include "base/process_util.h"
 #include "base/string_util.h"
 #include "base/utf_string_conversions.h"
+#include "chrome/browser/extensions/extension_process_manager.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/extensions/extension.h"
@@ -139,6 +140,8 @@ void MemoryDetails::CollectChildInfoOnUIThread() {
       Profile* profile =
           Profile::FromBrowserContext(render_process_host->browser_context());
       ExtensionService* extension_service = profile->GetExtensionService();
+      ExtensionProcessManager* extension_process_manager =
+          profile->GetExtensionProcessManager();
 
       // The RenderProcessHost may host multiple TabContents.  Any
       // of them which contain diagnostics information make the whole
@@ -168,7 +171,8 @@ void MemoryDetails::CollectChildInfoOnUIThread() {
             process.renderer_type = ChildProcessInfo::RENDERER_DEVTOOLS;
           else
             process.renderer_type = ChildProcessInfo::RENDERER_CHROME;
-        } else if (host->enabled_bindings() & BindingsPolicy::EXTENSION) {
+        } else if (extension_process_manager->AreBindingsEnabledForProcess(
+                   host->process()->id())) {
           process.renderer_type = ChildProcessInfo::RENDERER_EXTENSION;
         }
         TabContents* contents = host_delegate->GetAsTabContents();
diff --git a/chrome/browser/renderer_host/chrome_render_view_host_observer.cc b/chrome/browser/renderer_host/chrome_render_view_host_observer.cc
index 2bc48d2..6b573b5 100644
--- a/chrome/browser/renderer_host/chrome_render_view_host_observer.cc
+++ b/chrome/browser/renderer_host/chrome_render_view_host_observer.cc
@@ -75,8 +75,8 @@ void ChromeRenderViewHostObserver::InitRenderViewHostForExtensions() {
   // Register the association between extension and SiteInstance with
   // ExtensionProcessManager.
   // TODO(creis): Use this to replace SetInstalledAppForRenderer.
-  process_manager->RegisterExtensionSiteInstance(site_instance->id(),
-                                                 extension->id());
+  process_manager->RegisterExtensionSiteInstance(site_instance,
+                                                 extension);
 
   if (extension->is_app()) {
     // Record which, if any, installed app is associated with this process.
@@ -85,20 +85,6 @@ void ChromeRenderViewHostObserver::InitRenderViewHostForExtensions() {
     profile->GetExtensionService()->SetInstalledAppForRenderer(
         render_view_host()->process()->id(), extension);
   }
-
-  // Enable extension bindings for the renderer. Currently only extensions,
-  // packaged apps, and hosted component apps use extension bindings.
-  Extension::Type type = extension->GetType();
-  if (type == Extension::TYPE_EXTENSION ||
-      type == Extension::TYPE_USER_SCRIPT ||
-      type == Extension::TYPE_PACKAGED_APP ||
-      (type == Extension::TYPE_HOSTED_APP &&
-       extension->location() == Extension::COMPONENT)) {
-    render_view_host()->AllowBindings(BindingsPolicy::EXTENSION);
-    ChildProcessSecurityPolicy::GetInstance()->GrantExtensionBindings(
-        render_view_host()->process()->id());
-    process_manager->RegisterProcessHost(render_view_host()->process()->id());
-  }
 }
 
 void ChromeRenderViewHostObserver::InitRenderViewForExtensions() {
diff --git a/chrome/chrome_tests.gypi b/chrome/chrome_tests.gypi
index 691e8c6..a35d5c2 100644
--- a/chrome/chrome_tests.gypi
+++ b/chrome/chrome_tests.gypi
@@ -2115,7 +2115,6 @@
             'app/chrome_dll.rc',
             'browser/accessibility/browser_accessibility_win_unittest.cc',
             'browser/bookmarks/bookmark_node_data_unittest.cc',
-            'browser/extensions/extension_process_manager_unittest.cc',
             'browser/rlz/rlz_unittest.cc',
             'browser/search_engines/template_url_scraper_unittest.cc',
             'browser/ui/views/bookmarks/bookmark_editor_view_unittest.cc',
diff --git a/content/browser/child_process_security_policy.cc b/content/browser/child_process_security_policy.cc
index 81d3964..44dad89 100644
--- a/content/browser/child_process_security_policy.cc
+++ b/content/browser/child_process_security_policy.cc
@@ -96,10 +96,6 @@ class ChildProcessSecurityPolicy::SecurityState {
     return BindingsPolicy::is_web_ui_enabled(enabled_bindings_);
   }
 
-  bool has_extension_bindings() const {
-    return BindingsPolicy::is_extension_enabled(enabled_bindings_);
-  }
-
   bool can_read_raw_cookies() const {
     return can_read_raw_cookies_;
   }
@@ -132,7 +128,6 @@ ChildProcessSecurityPolicy::ChildProcessSecurityPolicy() {
   RegisterWebSafeScheme(chrome::kFtpScheme);
   RegisterWebSafeScheme(chrome::kDataScheme);
   RegisterWebSafeScheme("feed");
-  RegisterWebSafeScheme(chrome::kExtensionScheme);
   RegisterWebSafeScheme(chrome::kBlobScheme);
   RegisterWebSafeScheme(chrome::kFileSystemScheme);
 
@@ -313,16 +308,6 @@ void ChildProcessSecurityPolicy::GrantWebUIBindings(int child_id) {
   state->second->GrantScheme(chrome::kFileScheme);
 }
 
-void ChildProcessSecurityPolicy::GrantExtensionBindings(int child_id) {
-  base::AutoLock lock(lock_);
-
-  SecurityStateMap::iterator state = security_state_.find(child_id);
-  if (state == security_state_.end())
-    return;
-
-  state->second->GrantBindings(BindingsPolicy::EXTENSION);
-}
-
 void ChildProcessSecurityPolicy::GrantReadRawCookies(int child_id) {
   base::AutoLock lock(lock_);
 
@@ -432,16 +417,6 @@ bool ChildProcessSecurityPolicy::HasWebUIBindings(int child_id) {
   return state->second->has_web_ui_bindings();
 }
 
-bool ChildProcessSecurityPolicy::HasExtensionBindings(int child_id) {
-  base::AutoLock lock(lock_);
-
-  SecurityStateMap::iterator state = security_state_.find(child_id);
-  if (state == security_state_.end())
-    return false;
-
-  return state->second->has_extension_bindings();
-}
-
 bool ChildProcessSecurityPolicy::CanReadRawCookies(int child_id) {
   base::AutoLock lock(lock_);
 
diff --git a/content/browser/child_process_security_policy.h b/content/browser/child_process_security_policy.h
index 943fd2d..ac01b2e 100644
--- a/content/browser/child_process_security_policy.h
+++ b/content/browser/child_process_security_policy.h
@@ -107,9 +107,6 @@ class CONTENT_EXPORT ChildProcessSecurityPolicy {
   // Grant the child process the ability to use Web UI Bindings.
   void GrantWebUIBindings(int child_id);
 
-  // Grant the child process the ability to use extension Bindings.
-  void GrantExtensionBindings(int child_id);
-
   // Grant the child process the ability to read raw cookies.
   void GrantReadRawCookies(int child_id);
 
@@ -141,11 +138,6 @@ class CONTENT_EXPORT ChildProcessSecurityPolicy {
   // allowed to use WebUIBindings.
   bool HasWebUIBindings(int child_id);
 
-  // Returns true if the specified child_id has been granted WebUIBindings.
-  // The browser should check this property before assuming the child process is
-  // allowed to use extension bindings.
-  bool HasExtensionBindings(int child_id);
-
   // Returns true if the specified child_id has been granted ReadRawCookies.
   bool CanReadRawCookies(int child_id);
 
diff --git a/content/browser/child_process_security_policy_unittest.cc b/content/browser/child_process_security_policy_unittest.cc
index 673766a..b1fc67b0 100644
--- a/content/browser/child_process_security_policy_unittest.cc
+++ b/content/browser/child_process_security_policy_unittest.cc
@@ -45,7 +45,6 @@ TEST_F(ChildProcessSecurityPolicyTest, IsWebSafeSchemeTest) {
   EXPECT_TRUE(p->IsWebSafeScheme(chrome::kFtpScheme));
   EXPECT_TRUE(p->IsWebSafeScheme(chrome::kDataScheme));
   EXPECT_TRUE(p->IsWebSafeScheme("feed"));
-  EXPECT_TRUE(p->IsWebSafeScheme(chrome::kExtensionScheme));
   EXPECT_TRUE(p->IsWebSafeScheme(chrome::kBlobScheme));
   EXPECT_TRUE(p->IsWebSafeScheme(chrome::kFileSystemScheme));
 
@@ -98,7 +97,6 @@ TEST_F(ChildProcessSecurityPolicyTest, StandardSchemesTest) {
   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("data:text/html,<b>Hi</b>")));
   EXPECT_TRUE(p->CanRequestURL(kRendererID,
                                GURL("view-source:http://www.google.com/")));
-  EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("chrome-extension://xy/z")));
   EXPECT_TRUE(p->CanRequestURL(
       kRendererID, GURL("filesystem:http://localhost/temporary/a.gif")));
 
diff --git a/content/common/bindings_policy.h b/content/common/bindings_policy.h
index 2dcea30..489ebef 100644
--- a/content/common/bindings_policy.h
+++ b/content/common/bindings_policy.h
@@ -21,9 +21,6 @@ class BindingsPolicy {
     DOM_AUTOMATION = 1 << 1,
     // Bindings that allow access to the external host (through automation).
     EXTERNAL_HOST = 1 << 2,
-    // Special bindings with privileged APIs for code running in the extension
-    // process.
-    EXTENSION = 1 << 3,
   };
 
   static bool is_web_ui_enabled(int flags) {
@@ -35,9 +32,6 @@ class BindingsPolicy {
   static bool is_external_host_enabled(int flags) {
     return (flags & EXTERNAL_HOST) != 0;
   }
-  static bool is_extension_enabled(int flags) {
-    return (flags & EXTENSION) != 0;
-  }
 };
 
 #endif  // CONTENT_COMMON_BINDINGS_POLICY_H_